Every CVE Search/ Get API key

CVE-2020-24330

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...

7.8 HighFix available

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.49%Down 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
CVE-2020-24330
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-269
Updated
2026-11-02
CVE List No score

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
CVE-2020-24330
Updated
2026-11-02
EUVDEUVD-2020-17064 No score

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
EUVD-2020-17064
Updated
2026-11-03
GitHub AdvisoriesGHSA-phqh-fwjq-q59q 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
GHSA-phqh-fwjq-q59q
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269, CWE-732
Updated
2026-11-02
OSVAZL-6925 7.8

CVE-2020-24330 affecting package trousers for versions less than 0.3.14-7

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
AZL-6925
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
CVE-2020-24330
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2020-24330 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
DEBIAN-CVE-2020-24330
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1627 7.8

Red Hat Security Advisory: trousers security, bug fix, and enhancement update

Record
RHSA-2021:1627
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:1627 7.8

Moderate: trousers security, bug fix, and enhancement update

TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.

The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)

Security Fix(es):

  • trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)

  • trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)

  • trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1627
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-24330 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Record
UBUNTU-CVE-2020-24330
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:1627 No score

Moderate: trousers security, bug fix, and enhancement update

TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.

The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)

Security Fix(es):

  • trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)

  • trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)

  • trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:1627
Updated
2026-11-02
OSVMGASA-2021-0297 No score

Updated trousers packages fix security vulnerabilities

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed (CVE-2020-24330).

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon) (CVE-2020-24331).

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack (CVE-2020-24332).

Record
MGASA-2021-0297
Updated
2026-11-02
OSVSUSE-SU-2022:2798-1 No score

Security update for trousers

This update for trousers fixes the following issues:

  • CVE-2020-24330: Fixed a potential tss user to root privilege escalation issue (bsc#1164472).
Record
SUSE-SU-2022:2798-1
Updated
2026-11-02
OSVSUSE-SU-2022:2800-1 No score

Security update for trousers

This update for trousers fixes the following issues:

  • CVE-2020-24330: Fixed a potential tss user to root privilege escalation issue (bsc#1164472).
Record
SUSE-SU-2022:2800-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
trousers
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers-lib
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers
Azure Linux:2
 before 0.3.14-7
0.3.14-7
trousers
Debian:12
 before 0.3.15-0.1
0.3.15-0.1
trousers
Debian:13
 before 0.3.15-0.1
0.3.15-0.1
trousers
Debian:14
 before 0.3.15-0.1
0.3.15-0.1
trousers
Mageia:7
From an advisory covering 3 CVEs
 before 0.3.14-4.2.mga7
0.3.14-4.2.mga7
trousers
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
Show 16 moreShow less
Affected packages
PackageAffectedFixed
trousers-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.3.14-150000.3.3.1
0.3.14-150000.3.3.1
trousers
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.3.14-150000.3.3.1
0.3.14-150000.3.3.1
trousers
SUSE:Linux Enterprise Server 15-LTSS
 before 0.3.14-150000.3.3.1
0.3.14-150000.3.3.1
trousers
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.3.14-150000.3.3.1
0.3.14-150000.3.3.1
trousers
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 0.3.13-3.3.1
0.3.13-3.3.1
trousers
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.3.13-4
 None known
trousers
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.14+fixed1-10.3.14+fixed1-1build1
 None known
trousers
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3.14+fixed1-1build1
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24330 is a high vulnerability (CVSS 7.8) in Trousers Project Trousers, published August 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in trousers 0.3.14-7.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open